Removing sIDHistory attribute

When using PowerShell Commands for Active Directory modifications on AD objects are scripted easily.
But dealing with some properties (e.g., sIDHistory) requires a special approach.

Let's say we need to clear the sIDHistory for the account TEST01
This account does have the sIDHistory attribute populated



[PS] C:\>$user=Get-QADUser -SamAccountName TEST01  -IncludedProperties sidhistory


[PS] C:\>$user.sIDHistory
0105000000000005150000002B012212B316AD0EEE04CFAD576F1600


If we want to clear an attribute like DisplayName we can use Set-QADUser and set the attribute to $null like this:


[PS] C:\>Set-QADUser $user -ObjectAttributes @{DisplayName=$null}


Name                    Type            DN
----                    ----            --
Test01,User             user            CN=Test01, User...

or that

[PS] C:\>Set-QADUser $user -ObjectAttributes @{DIsplayName=@{delete=$user.DisplayName}}


Name                    Type            DN
----                    ----            --
Test01,User             user            CN=Test01, User...

But what happens when we try the same syntax for sIDHistory:


[PS] C:\>Set-QADUser $user -ObjectAttributes @{sidhistory=$null}
Set-QADUser : General access denied error
At line:1 char:12
+ Set-QADUser  <<<< $user -ObjectAttributes @{sidhistory=$null}
[PS] C:\>

This didn't work. Let's try the second option.

[PS] C:\>Set-QADUser $user -ObjectAttributes @{sidhistory=@{delete=$user.sidhistory}}
Set-QADUser : The specified directory service attribute or value does not exist
. (Exception from HRESULT: 0x8007200A)
At line:1 char:12
+ Set-QADUser  <<<< $user -ObjectAttributes @{sidhistory=@{delete=$user.sidhistory}}

we got a different error. At least it doesn't complain anymore about the permissions. But how can we specify sIDHistory? If we check the property of the object with get-member we'll find out that

sIDHistory                    NoteProperty          System.String sIDHistory..

is a NoteProperty and as such it needs to be referenced as  $user['sidhistory'] (it's case-insensitive).

And after that we can finaly clear the sIDHistory attribute

[PS] C:\>Set-QADUser $user -ObjectAttributes @{sidhistory=@{delete=$user['sidhistory']}}


Name                    Type            DN
----                    ----            --
Test01,User             user            CN=Test01, User...